Our Cisco ACS was accidentally made useless by some numbskull (me) by raising the functionality level of our AD domain, apparently ACS 4.2 is not compatible with newer MS AD servers ... and once you raise the functionality level ... you can't go back ... go me >:o So! I am trying to replicate the Downloadable IP ACL function that we love so much in ACS, into Free RADIUS. It seems that this is done through the Cisco AV Pair radius attribute. If anyone has experience in this please drop me a line using my included contact info, if we move into production with it I will post back to the list for posterity what we did to get it to work. Any help is always appreciated. Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221
On 13 Sep 2011, at 21:59, Sallee, Stephen (Jake) wrote:
Our Cisco ACS was accidentally made useless by some numbskull (me) by raising the functionality level of our AD domain, apparently ACS 4.2 is not compatible with newer MS AD servers … and once you raise the functionality level … you can’t go back … go me >:o
So! I am trying to replicate the Downloadable IP ACL function that we love so much in ACS, into Free RADIUS. It seems that this is done through the Cisco AV Pair radius attribute. If anyone has experience in this please drop me a line using my included contact info, if we move into production with it I will post back to the list for posterity what we did to get it to work.
Or update the Cisco wiki page? :) Could always setup ACS with local accounts and do a network trace? It's not likely to be encrypted or anything special. -Arran
Any help is always appreciated.
Jake Sallee Godfather of Bandwidth System Engineer University of Mary Hardin-Baylor 900 College St. Belton, Texas 76513 Fone: 254-295-4658 Phax: 254-295-4221
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Arran Cudbard-Bell a.cudbardb@freeradius.org RADIUS - Waging war on ignorance and apathy one Access-Challenge at a time.
"Sallee, Stephen (Jake)" <Jake.Sallee@umhb.edu> writes:
So! I am trying to replicate the Downloadable IP ACL function that we love so much in ACS, into Free RADIUS. It seems that this is done through the Cisco AV Pair radius attribute. If anyone has experience in this please drop me a line using my included contact info, if we move into production with it I will post back to the list for posterity what we did to get it to work.
I have absolutely no idea what Cisco ACS is doing, but this is how you normally send an IP ACL from FreeRADIUS to an IOS device: Cisco-AVPair += "ip:inacl#1=permit tcp any any eq 80", Cisco-AVPair += "ip:inacl#2=deny ip any any" It's a bit strange since they wrap tacacs+ attributes inside one RADIUS VSA (Cisco-AVPair), but once you get that then it makes sort of sense.. Bjørn
participants (3)
-
Arran Cudbard-Bell -
Bjørn Mork -
Sallee, Stephen (Jake)